CVE-2026-22706

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22706", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-08T19:23:09.857Z", "datePublished": "2026-05-14T18:38:26.745Z", "dateUpdated": "2026-05-15T14:52:06.866Z"}, "containers": {"cna": {"title": "Strapi: Password Reset Does Not Revoke Existing Refresh Sessions", "problemTypes": [{"descriptions": [{"cweId": "CWE-613", "lang": "en", "description": "CWE-613: Insufficient Session Expiration", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.1, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/strapi/strapi/security/advisories/GHSA-hvp3-26wx-g2w4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/strapi/strapi/security/advisories/GHSA-hvp3-26wx-g2w4"}], "affected": [{"vendor": "strapi", "product": "strapi", "versions": [{"version": "< 5.33.3", "status": "affected"}]}, {"vendor": "strapi", "product": "@strapi/admin", "versions": [{"version": "< 5.33.3", "status": "affected"}]}, {"vendor": "strapi", "product": "@strapi/plugin-users-permissions", "versions": [{"version": "< 5.33.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-14T18:38:26.745Z"}, "descriptions": [{"lang": "en", "value": "Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the user's existing refresh-token sessions by default. The refresh-token invalidation step in the users-permissions and admin authentication controllers was conditional on a caller-supplied `deviceId`. When a password change or reset request did not include a `deviceId`, no refresh tokens were revoked, leaving every prior session active. An attacker who had previously obtained a refresh token could continue minting new access tokens after the legitimate user reset their password, allowing persistent unauthorized access for the lifetime of the refresh token (up to 30 days by default). Rotating credentials no longer terminated an active attacker session, defeating password reset as a containment measure. The patch in version 5.33.3 invalidates all refresh tokens associated with the user on every password change and password reset, regardless of whether a `deviceId` is supplied. A new device-scoped session is then issued to the caller as part of the response."}], "source": {"advisory": "GHSA-hvp3-26wx-g2w4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-15T14:50:52.300520Z", "id": "CVE-2026-22706", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-15T14:52:06.866Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22706", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-15T14:50:52.300520Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-15T14:51:52.256Z"}}], "cna": {"title": "Strapi: Password Reset Does Not Revoke Existing Refresh Sessions", "source": {"advisory": "GHSA-hvp3-26wx-g2w4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "strapi", "product": "strapi", "versions": [{"status": "affected", "version": "< 5.33.3"}]}, {"vendor": "strapi", "product": "@strapi/admin", "versions": [{"status": "affected", "version": "< 5.33.3"}]}, {"vendor": "strapi", "product": "@strapi/plugin-users-permissions", "versions": [{"status": "affected", "version": "< 5.33.3"}]}], "references": [{"url": "https://github.com/strapi/strapi/security/advisories/GHSA-hvp3-26wx-g2w4", "name": "https://github.com/strapi/strapi/security/advisories/GHSA-hvp3-26wx-g2w4", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the user's existing refresh-token sessions by default. The refresh-token invalidation step in the users-permissions and admin authentication controllers was conditional on a caller-supplied `deviceId`. When a password change or reset request did not include a `deviceId`, no refresh tokens were revoked, leaving every prior session active. An attacker who had previously obtained a refresh token could continue minting new access tokens after the legitimate user reset their password, allowing persistent unauthorized access for the lifetime of the refresh token (up to 30 days by default). Rotating credentials no longer terminated an active attacker session, defeating password reset as a containment measure. The patch in version 5.33.3 invalidates all refresh tokens associated with the user on every password change and password reset, regardless of whether a `deviceId` is supplied. A new device-scoped session is then issued to the caller as part of the response."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-613", "description": "CWE-613: Insufficient Session Expiration"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-14T18:38:26.745Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22706", "state": "PUBLISHED", "dateUpdated": "2026-05-15T14:52:06.866Z", "dateReserved": "2026-01-08T19:23:09.857Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-14T18:38:26.745Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "strapi", "vendor": "strapi", "versions": [{"status": "affected", "version": "< 5.33.3"}]}, {"product": "@strapi/admin", "vendor": "strapi", "versions": [{"status": "affected", "version": "< 5.33.3"}]}, {"product": "@strapi/plugin-users-permissions", "vendor": "strapi", "versions": [{"status": "affected", "version": "< 5.33.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:strapi:strapi:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "FD0D7690-E4F7-4636-8C0C-52C992F905C6", "versionEndExcluding": "5.33.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the user's existing refresh-token sessions by default. The refresh-token invalidation step in the users-permissions and admin authentication controllers was conditional on a caller-supplied `deviceId`. When a password change or reset request did not include a `deviceId`, no refresh tokens were revoked, leaving every prior session active. An attacker who had previously obtained a refresh token could continue minting new access tokens after the legitimate user reset their password, allowing persistent unauthorized access for the lifetime of the refresh token (up to 30 days by default). Rotating credentials no longer terminated an active attacker session, defeating password reset as a containment measure. The patch in version 5.33.3 invalidates all refresh tokens associated with the user on every password change and password reset, regardless of whether a `deviceId` is supplied. A new device-scoped session is then issued to the caller as part of the response."}, {"lang": "es", "value": "Strapi es un sistema de gesti\u00f3n de contenido headless de c\u00f3digo abierto. En versiones de Strapi anteriores a la 5.33.3, cambiar o restablecer la contrase\u00f1a de un usuario no invalidaba las sesiones de refresh-token existentes del usuario por defecto. El paso de invalidaci\u00f3n del refresh-token en los controladores de autenticaci\u00f3n de usuarios-permisos y de administrador era condicional a un \u2019deviceId\u2019 proporcionado por el llamador. Cuando una solicitud de cambio o restablecimiento de contrase\u00f1a no inclu\u00eda un \u2019deviceId\u2019, no se revocaban los refresh tokens, dejando activa cada sesi\u00f3n anterior. Un atacante que hab\u00eda obtenido previamente un refresh token pod\u00eda continuar generando nuevos access tokens despu\u00e9s de que el usuario leg\u00edtimo restableciera su contrase\u00f1a, permitiendo un acceso no autorizado persistente durante la vida \u00fatil del refresh token (hasta 30 d\u00edas por defecto). La rotaci\u00f3n de credenciales ya no terminaba una sesi\u00f3n de atacante activa, frustrando el restablecimiento de contrase\u00f1a como medida de contenci\u00f3n. El parche en la versi\u00f3n 5.33.3 invalida todos los refresh tokens asociados con el usuario en cada cambio y restablecimiento de contrase\u00f1a, independientemente de si se proporciona un \u2019deviceId\u2019. Una nueva sesi\u00f3n con \u00e1mbito de dispositivo se emite entonces al llamador como parte de la respuesta."}], "id": "CVE-2026-22706", "lastModified": "2026-10-26T14:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22706", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-15T14:50:52.300520Z", "version": "2.0.3"}}]}, "published": "2026-05-14T19:16:30.700", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/strapi/strapi/security/advisories/GHSA-hvp3-26wx-g2w4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-613"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.33.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "@strapi/admin", "source": "cna", "vendor": "strapi"}, "product": "admin", "vendor": "strapi"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.33.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "@strapi/plugin-users-permissions", "source": "cna", "vendor": "strapi"}, "product": "plugin-users-permissions", "vendor": "strapi"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.33.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "strapi", "source": "cna", "vendor": "strapi"}, "product": "strapi", "vendor": "strapi"}], "created": "2026-05-14T20:30:04.131120+00:00", "updated": "2026-05-17T17:02:04.027743+00:00", "vendors": ["strapi", "strapi$PRODUCT$admin", "strapi$PRODUCT$plugin-users-permissions", "strapi$PRODUCT$strapi"]}